Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Understanding Standalone ISSU

Standalone in‑service software upgrade (ISSU) is a feature that minimizes data traffic loss during the software upgrade process.

Starting in Junos OS Release 26.2R1, standalone ISSU enables an EX4400 switch with a single Routing Engine to upgrade Junos OS with uninterrupted data plane forwarding and a minimal control plane unavailability window. During this window, the forwarding entries remain programmed and continue to switch traffic while the control plane performs a warm reboot.

Benefits of Standalone ISSU

  • Reduce upgrade downtime in access deployments that require continuous connectivity.

  • Preserve key session and forwarding states to avoid traffic loss after the upgrade.

  • Minimize traffic disruption by maintaining data plane forwarding while the control plane restarts.

  • Maintains uninterrupted Power over Ethernet (PoE) to ensure service continuity for powered devices.

Understanding the Standalone ISSU Process

After you run the request system software in-service-upgrade command on an EX4400 switch, the following processes occur:

  • Validate: The system validates the package and resources, then stages the image.

  • Prepare: Participating processes prepare for upgrade.

  • Warm Boot: The Packet Forwarding Engine (PFE) enters a warm‑boot sequence.

  • Save States: Interface, kernel, and platform states are saved for restoration after the reboot.

  • Restore: The device boots the new image, then saved states are restored.

  • Reconcile: The system restores the host path and reconciles any state differences so the control plane resumes normal operation.

Configuration changes are not allowed during ISSU.

During the upgrade window, data‑plane forwarding uses the last known configuration. New control‑plane learning and signaling are deferred until the host path is restored.

Standalone ISSU completes in approximately 210 seconds after you run the command. During this window, packet loss is less than 50 milliseconds.

Supported Protocols

The following table lists the protocols supported during a standalone ISSU on an EX4400 switch starting in Junos OS Release 26.2R1:

Table 1: Supported Protocols
Protocol Standalone ISSU Behavior

Layer 2 and Layer 3 unicast

Forwarding continues for existing entries. MAC entries learned before the ISSU window are not aged during the window. Only IPv4 is support for Layer 3 unicast.

Layer 2 multicast

Forwarding continues for already-learned multicast group traffic. New entries are not learned during the ISSU window.

LACP

LACP PDUs continue to be sent throughout the ISSU window. Received LACP PDUs are not processed because the host path is unavailable.

LLDP

As part of ISSU preparation, the hello timer is changed to 60 seconds and the TTL to 240 seconds, preventing peer devices from losing LLDP neighborship during the window.

DHCP security

New DHCP binding entries are not learned during the ISSU window. DHCP transactions are not processed through the switch during this window.

802.1X

Authentication sessions are preserved. New authentication requests are rejected, and authentication sessions in progress are cleared during the ISSU window. If reauthorization is scheduled during the ISSU window, it is deferred to post-ISSU.

OSPF

Graceful restart preserves routes and resynchronizes with peers.

BGP

Graceful restart preserves routes and resynchronizes with peers.

PoE

Power delivery to connected powered devices continues uninterrupted throughout the ISSU window. LLDP-based power TLVs are not processed during this window. The switch does not support power negotiation for already-connected powered devices and does not support detection or power negotiation for newly connected powered devices during the ISSU window.

MAC limit

The mac-limit count is frozen during the ISSU window, and MAC limit enforcement actions are not triggered. Ports that had a MAC limit action applied before ISSU retain that state throughout the window. All MAC limit actions are reset and affected ports are brought back up after ISSU completes.

Storm control

Storm control configuration is stored by the kernel during ISSU. After ISSU, the kernel restores the storm control configuration to l2ald during post-ISSU reconciliation.

Firewall filters

Firewall filter rules remain programmed in hardware throughout the ISSU window, and the data plane continues to enforce them.​

BPDU for edge ports

bpdu-block-on-edge behavior is maintained throughout the ISSU window. xSTP protocols are not supported during ISSU.
Note:

Enable graceful restart on OSPF and BGP peers to maintain uninterrupted forwarding during standalone ISSU.

Unsupported Protocols

The following protocols are unsupported during standalone ISSU:

  • MACsec

  • MSTP

  • VSTP

  • RSTP for non-edge ports

  • DHCP client, relay, and server

Performing a Standalone ISSU

This example uses the following hardware and software components:

  • An EX4400 switch

  • Junos OS Release 26.2R1 or later

Before you begin:

  • Download the software package from the Juniper Networks Support website at https://www.juniper.net/support/ and place the package on your local server.

  • Copy the Junos OS software package to the device by using the file copy ftp://username@hostname.net/filename /var/tmp/filename command.

  • Storage usage in /var/tmp must be below 85%.

  • Enable graceful restart on OSPF and BGP peers to maintain uninterrupted forwarding during standalone ISSU.

To run the standalone ISSU process, follow these steps:

CAUTION:
ISSU starts immediately when you enter the request system software in-service-upgrade command and cannot be paused or interrupted.
  1. Start the Single‑RE ISSU process with the request system software in-service-upgrade package-name command.
  2. Monitor ISSU progress through logs with the show log messages command:
  3. After ISSU completes, use the following commands to verify that the device is running the new software, host I/O is restored, and key features are operating:
  4. Validate reachability and check for end-to-end connectivity after ISSU completes:

Limitations and Caveats

Before you perform a standalone ISSU, choose a time when your network is as stable as possible. As with a normal upgrade, Telnet sessions, SNMP, and CLI access are briefly interrupted. In addition, the following restrictions apply:

  • Only forwarding state is preserved during standalone ISSU. For OSPF and BGP, protocol state is rebuilt using graceful restart after the control plane recovers.

  • Single‑RE ISSU isn’t supported for Virtual Chassis.

  • Components that require a CPU or CPLD reset aren’t updated by Single‑RE ISSU.

  • New control‑plane learning and interface link‑state monitoring are deferred during the upgrade window.

  • CPU and resource monitoring aren’t available during the upgrade window.

  • New DHCP clients on VLANs with DHCP security enabled cannot complete DHCP transactions during the ISSU window.

  • Layer 3 unicast forwarding supports only IPv4 during standalone ISSU.

  • If the upgrade can’t complete successfully, the system terminates the process and returns to standard software upgrade behavior on reboot.